IN THE CLAIMS : 

Please cancel claims 1-3, 6-12, and 20 without prejudice or disclaimer. Please 
amend claims 4, 13, and 16-19 as follows. Please add new claims 21-29 as follows. 

1-3. (Cancelled) 

4. (Currently Amended) TheAn apparatus^ according to claim L farther 
comprising,: 

a router configured to route subscriber traffic flow between at least two wireless 
access networks and an internet protocol network, wherein the at least two wireless 
access networks correspond to different customer networks; 

a generator configured to generate at least one instance for executing a security 
function on a subscriber traffic flow, so that physically one security instance for 
subscribers of at least two wireless access networks is present and logically at least one of 
the at least two wireless access networks has a respective security instance; and 

-a reorganizer configured to reorganize a context from a first logical part of the 
security instance associated with a first wireless access network of the at least two 
wireless access networks to a second logical part of the security instance associated with 
a second wireless access network of the at least two wireless access networks. 
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5. (Previously Presented) The apparatus according to claim 4, wherein the 
reorganizer is configured to reorganize the context from the first logical part to the 
second logical part in case of a handover of a subscriber from the first wireless access 
network to the second wireless access network. 

6-12. (Cancelled) 

13. (Currently Amended) The A method ^ according to claim 8, further 
comprising: 

providing at least one instance to execute a security function on subscriber traffic 
flow routed between at least two wireless access networks and an internet protocol 
network, wherein the at least two wireless access networks correspond to different 
customer networks, by logically separating the at least one instance for at least two 
wireless access networks, so that physically one security instance for subscribers of the at 
least two wireless access networks is present and logically at least one of the at least two 
wireless access networks has a respective security instance: and 

reorganizing a context from a first logical part of the security instance associated 
with a first wireless access network of the at least two wireless access networks to a 
second logical part of the security instance associated with a second wireless access 
network of the at least two wireless access networks. 
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14. (Previously Presented) The method according to claim 13, wherein the 
reorganizing comprises reorganizing the context from the first logical part to the second 
logical part in case of a handover of a subscriber from the first wireless access network to 
the second wireless access network. 

15. (Previously Presented) The method according to claim 14, wherein the 
reorganizing comprises reorganizing a handover context pertaining to the subscriber 
handed over from the first wireless access network to the second wireless access network. 

16. (Currently Amended) A network node, comprising: 

a connection which connects configured to communicatively connect a network 
node to a distributed routing device configured to route subscriber traffic flow to and 
from an internet protocol network, wherein the distributed routing device is configured to 
route subscriber traffic flow between at least two wireless access networks and an 
internet protocol network, wherein the at least two wireless access networks correspond 
to different customer networks, and the distributed routing device comprises at least one 
instance for executing configured to execute a security function on a subscriber traffic 
flow, so that physically one security instance for subscribers of at least two wireless 
access networks is present and logically at least one of the at least two wireless access 
networks has a respective security instance, wherein at least one logical part of the 
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security instance is associated with a context of a respective one of the wireless access 
networks and comprises an interface with the respective wireless access network; and 

a modifying device configured to modify the context in the at least one logical part 
of the security instance associated with the respective one of the wireless access network 
via a respectively provided interface. 

17. (Currently Amended) A network system, comprising: 

at least two wireless access networks and a distributed routing device configured 
to route subscriber traffic flow between the at least two wireless access networks and an 
internet protocol network, wherein the at least two wireless access networks correspond 
to different customer networks, wherein the distributed routing device is configured to 
route subscriber traffic flow between at least two wireless access networks and an 
internet protocol network, and the distributed routing device comprises at least one 
instance for executing configured to execute a security function on a subscriber traffic 
flow, so that physically one security instance for subscribers of at least two wireless 
access networks is present and logically at least one of the at least two wireless access 
networks has a respective security instance , and a reorganizer configured to reorganize a 
context from a first logical part of the security instance associated with a first wireless 
access network of the at least two wireless access networks to a second logical part of the 
security instance associated with a second wireless access network of the at least two 
wireless access networks. 
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18. (Currently Amended) An apparatus, comprising: 

routing means for routing subscriber traffic flow between at least two wireless 
access networks and an internet protocol network, wherein the at least two wireless 
access networks correspond to different customer networks ;-and 

generating means for generating at least one instance for executing a security 
function on a subscriber traffic flow, so that physically one security instance for 
subscribers of at least two wireless access networks is present and logically at least one of 
the at least two wireless access networks has a respective security instance ; and 

reorganizing means for reorganizing a context from a first logical part of the 
security instance associated with a first wireless access network of the at least two 
wireless access networks to a second logical part of the security instance associated with 
a second wireless access network of the at least two wireless access networks . 

19. (Currently Amended) A network node, comprising: 

connection means for communicatively connecting a network node to distributed 
routing means for routing subscriber traffic flow to and from an internet protocol 
network, wherein the distributed routing means routes subscriber traffic flow between at 
least two wireless access networks and an internet protocol network, wherein the at least 
two wireless access networks correspond to different customer networks, and the 
distributed routing device comprises at least one instance for executing a security 
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function on a subscriber traffic flow, so that physically one security instance for 
subscribers of at least two wireless access networks is present and logically at least one of 
the at least two wireless access networks has a respective security instance, wherein at 
least one logical part of the security instance is associated with a context of a respective 
one of the wireless access networks and comprises an interface with the respective 
wireless access network; and 

modifying means for modifying the context in the at least one logical part of the 
security instance associated with the respective one of the wireless access network via a 
respectively provided interface. 

20. (Cancelled) 

21. (New) A computer program, embodied on a computer readable medium, 
configured to control a processor to implement a method, the method comprising: 

providing at least one instance to execute a security function on subscriber traffic 
flow routed between at least two wireless access networks and an internet protocol 
network, wherein the at least two wireless access networks correspond to different 
customer networks, by logically separating the at least one instance for at least two 
wireless access networks, so that physically one security instance for subscribers of the at 
least two wireless access networks is present and logically at least one of the at least two 
wireless access networks has a respective security instance; and 
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reorganizing a context from a first logical part of the security instance associated 
with a first wireless access network of the at least two wireless access networks to a 
second logical part of the security instance associated with a second wireless access 
network of the at least two wireless access networks. 

22. (New) The apparatus according to claim 4, wherein at least one logical part of the 
security instance is associated with a context of a respective one of the wireless access 
networks and comprises an interface with the respective wireless access network. 

23. (New) The apparatus according to claim 4, further comprising an associating device 
configured to associate the subscribers with the at least two wireless access networks. 

24. (New) The apparatus according to claim 4 5 wherein the security function comprises 
at least one of a virtual private network, routing and firewall function. 

25. (New) The apparatus according to claim 4, wherein the apparatus is located at a 
provider edge of the internet protocol network. 

26. (New) The method according to claim 13, further comprising: 

associating at least one logical part of the security instance with a context of a 
respective one of the wireless access networks; and 
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providing an interface between the at least one logical part and the respective 
associated wireless access network. 

27. (New) The method according to claim 26, further comprising: 

modifying the context in the at least one logical part by the associated wireless 
access network via the respective interface. 

28. (New) The method according to claim 27, further comprising: 

detecting whether the context to be modified comprises a security code; and 
in case the context comprises the security code, inhibiting the modifying of the 
context. 

29. (New) The method according to claim 13, further comprising: 

associating the subscribers with the wireless access networks. 
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